On SRX devices managed via Mist, users may observe security log streaming configuration present on the device, even though no such configuration was explicitly applied from the Mist UI.

The following configuration may be found on the SRX device:

set groups mist-wa security log mode stream

set groups mist-wa security log stream app_usage format binary

set groups mist-wa security log stream app_usage category aamw

set groups mist-wa security log stream app_usage category content-security

set groups mist-wa security log stream app_usage category flow

set groups mist-wa security log stream app_usage category idp

set groups mist-wa security log stream app_usage category rtlog

set groups mist-wa security log stream app_usage category secintel

set groups mist-wa security log stream app_usage host srx-log-terminator.mist.com

set groups mist-wa security log stream app_usage host port 6514

set groups mist-wa security log stream app_usage host routing-instance <instance name>

set groups mist-wa security log stream app_usage transport tcp-connections 1

set groups mist-wa security log stream app_usage transport protocol tls

set groups mist-wa security log stream app_usage transport tls-profile app_usage

set groups mist-wa security log stream app_usage source-address x.x.x.x

This behavior is expected and does not indicate any misconfiguration on the device.

The security log streaming settings seen on the SRX are automatically applied by Mist under an internal configuration group to support application visibility and analytics features in the Mist dashboard.

Even though the user has not explicitly configured logging, Mist requires this telemetry to provide insights such as app usage and security events.

No manual action is needed from the user side, and it is recommended not to remove or alter this configuration, as doing so may impact the app visibility and reporting capabilities in the Mist UI.